Remote Code Execution via Deserialization in Open-Web-Analytics

A deserialization vulnerability exists in the Open-Web-Analytics (OWA) platform, specifically affecting versions 1.8.1 and earlier. The flaw resides within the Event::loadFromArray function located in the queue.php file, which is part of the Remote Event Queue Endpoint component. An unauthenticated remote attacker can exploit this vulnerability by sending a maliciously crafted payload to the endpoint, leading to insecure deserialization. Successful exploitation allows for arbitrary code execution on the underlying web server. Defenders should immediately upgrade to OWA version 1.8.2 or apply the official patch (78c1222ec0e2119d84684032da1541120a2cdd23) to mitigate this high-severity risk.

Impact

Successful exploitation of this vulnerability results in full remote code execution on the web server hosting Open-Web-Analytics. This could lead to a complete system compromise, unauthorized access to sensitive analytics data, or the use of the server as a pivot point for lateral movement within the network.

Recommendation

• Upgrade Open-Web-Analytics to version 1.8.2 immediately to remediate CVE-2026-97865.
• If an immediate upgrade is not possible, apply the specific patch 78c1222ec0e2119d84684032da1541120a2cdd23.
• Monitor web server access logs for anomalous POST requests directed at the queue.php endpoint that contain serialized object structures or unusual query parameters.